Week 15 self-check | AI GRCA Practice Lab

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

What role does the 'governance board' typically play under Clause 5, as distinct from day-to-day system owners?

System owners report to no one under Clause 5It has no distinct role from system ownersIt provides senior oversight, sets direction and approves policy, while system owners handle operational management of individual AI systemsThe governance board should approve every individual AI output

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

How does Clause 5/6 planning relate to NIST's GOVERN and MAP functions?

No relationshipLeadership commitment and risk-based planning parallel NIST's GOVERN and MAP functionsNIST functions replace ISO clauses entirelyOnly MEASURE relates to Clause 6

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

How should planning under Clause 6 treat a newly identified AI risk discovered mid-cycle, rather than at the original planning point?

Only Clause 9 can introduce new risks into planningIt should be ignored until the next full planning cycleThe 'planning changes' element of Clause 6 allows for controlled incorporation of newly identified risks outside the original planning cycleNew risks can never be added once a planning cycle starts

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

How should 'objectives and measurement' under Clause 6 be reviewed after a significant AI incident?

Incidents are irrelevant to Clause 6 objective-settingOnly Clause 10 addresses incidents, with no link back to Clause 6 objectivesObjectives should never be revisited after an incidentThe incident should prompt a review of whether existing objectives and measures adequately addressed the risk that materialised, adjusting them if not

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

Which is a leadership responsibility under Clause 5, not a purely operational task?

Setting AI policy and assigning roles, authorities and resourcesWriting the model's codeResponding to individual support ticketsManually reviewing every AI output

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

Which best distinguishes the role of an AI governance board from an operational AI ethics working group, where both exist?

They are always the same body under a different nameThe governance board typically holds ultimate oversight and approval authority; a working group may develop recommendations and detailed guidance for the board's considerationThe working group always outranks the governance boardOnly one of the two bodies is ever needed, never both

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

Why does 'senior management responsibilities' under Clause 5 typically include approving risk acceptance, not just policy?

Risk acceptance is always delegated to the most junior available staffPolicy approval and risk acceptance are the same single decisionSenior management has no role in risk acceptanceBecause accepting residual AI risk carries real organisational consequence, it needs authority matched to that level of decision, often senior leadership

WEEK 15 · ISO AI management · ISO/IEC 42001 Clause 5 and Clause 6: Leadership and Planning

How does this week's syllabus explicitly frame the alignment between ISO Clause 5/6 and NIST AI RMF?

As explicitly aligned — Clause 5/6 leadership and planning correspond conceptually to NIST's GOVERN and MAP functionsAs mutually exclusive frameworks that cannot be used togetherAs requiring a strict legal hierarchy between the twoAs entirely separate with no acknowledged relationship